Regulated IT Delivery Brief logo

Edition

Issue #3: Price Transparency Arrives in Five Waves

6 min read

The Signal

Two developments from October 5–11 will reach delivery teams before they reach most roadmaps.

Key dates: December 7, 2026: Transparency in Coverage final rule takes effect · December 11: continuing resolution expires · January 1, 2027: phone access to cost-sharing information for plan years starting on or after this date · On or around February 1, 2027: schema 3.0 for in-network and allowed-amount files · April 1, 2027: first quarterly in-network and allowed-amount files due

1. The price transparency rules for health plans were rewritten, with a phased schedule that runs into 2028. On October 5, HHS (through CMS), the Department of Labor, and the Treasury finalized the Transparency in Coverage rule (CMS-9882-F). It was published in the Federal Register on October 6 (91 FR 63748) and takes effect December 7, 2026. Group health plans and issuers will publish in-network rate and allowed-amount files quarterly instead of monthly, report in-network rates at the network level, and may leave out provider-rate combinations unlikely to be used, based on an internal provider taxonomy. Three new files are added: Taxonomy, Utilization, and a plain-language Text file. The out-of-network reporting threshold drops from 20 claims to 11, aggregated by market type. Every file must carry an attestation that names the CEO, president, or a similar senior official, and plans must link to the files from a website footer labeled "Price Transparency" or "Transparency in Coverage." Cost-sharing information must also be available by phone for plan years beginning on or after January 1, 2027. CMS estimates about $174.5 million a year in net savings starting in year two.

The Labor Department's October 7 FAQ (ACA Part 75) sets the build schedule. Schema 3.0 for in-network and allowed-amount files is due on or around February 1, 2027, with the first quarterly files due April 1, 2027. Until then, plans keep publishing monthly under schema 2.0. Taxonomy and Text schemas are due on or around June 1, 2027, with first files due October 1, 2027. The Utilization file follows on July 1, 2028. A prescription drug schema is expected around May 2027, with monthly drug files beginning December 2027.

2. ONC put federal research money behind agentic AI with guardrails built in. On October 6, ONC, the Office of the National Coordinator for Health IT, announced $1.5 million across two Leading Edge Acceleration Projects (LEAP in Health IT) awards. MedStar Health Research Institute will build "Sovereign Execution," open-source middleware for gated, verifiable agentic care: AI-coordinated clinical follow-ups that run over long periods, patient-controlled data pods built on the Solid protocol, and tamper-evident certificates for AI routing decisions. Regenstrief Institute will build a readiness-to-remediation toolkit to help at least three small, independent laboratories adopt standardized laboratory terminology.

Why It Matters

Neither of these looks like a delivery story in the headline. Each one becomes delivery work.

The effective date is not the deadline. December 7 is when the rule takes effect, but nothing new is due that day. The work arrives in five waves across eighteen months, each tied to a different file, schema, and owner. A plan that treats this as one compliance project with one go-live will either start too late or staff too early.

The specification arrives about two months before the first deadline. Schema 3.0 lands around February 1, and quarterly files are due April 1. That leaves roughly eight weeks to build, test, and publish against a new format, while the old monthly pipeline under schema 2.0 keeps running until the cutover. Two pipelines in parallel is a capacity problem, not just a technical one.

Accuracy now has a name attached. The attestation requirement puts a senior official's name on every file. That changes the conversation from "did we publish?" to "can we stand behind what we published?" The new taxonomy file ties what a plan publishes to how it actually adjudicates claims, so the data team, the claims team, and the network team now share one output.

Automated action needs a boundary and a record. The MedStar project's design choices are the point: gates before an AI agent acts, data the patient controls, and a tamper-evident record of what the agent decided. Those are the same controls any regulated program will need before agentic AI moves from pilot to production. This award is small, but it shows what reviewers are going to ask for.

Delivery Impact

The same two signals land differently depending on who is accountable for the work.

AudienceTransparency in CoverageAgentic AI with guardrails (LEAP)
Project and Scrum leadersPlan the schema 2.0 monthly run and the schema 3.0 build as separate work streams with separate capacity. Make schema validation and attestation sign-off explicit acceptance criteria, not a release-day step.For any AI agent in scope, write the gate (what it may do without a human), the data boundary, and the decision record into the definition of done.
Program and portfolio leadersMap the five waves (February, April, June, October 2027, July 2028) to owners across data, claims, network, and member services. Name who owns the taxonomy, because it decides what gets published.Inventory where agents act on regulated data today, including vendor features. Treat permission design and audit logging as shared platform work, not per-team decisions.
ExecutivesExpect to attest personally or delegate to a named official. Ask what evidence supports that signature before the first quarterly file goes out.Ask one question of every AI pilot: if this agent takes the wrong action, who approved its permissions, and where is the record?

My Take

Both stories come down to the same question: who stands behind this output? The transparency rule answers it directly, with a senior official's name in every file. The LEAP award answers it by design, with gates and tamper-evident records around what an AI agent is allowed to do. Neither is about the technology. Both are about accountability being made visible.

That is an identity and access question before it is anything else. An attestation is only as strong as the controls behind it: who can change the taxonomy, who approved the rate data, who can push a file to production. An AI agent is a new kind of identity, one that acts on its own and needs permissions, boundaries, and an audit trail just like a person would. Programs that already govern access well will find both of these easier. Programs that don't will discover the gap when someone is asked to sign.

Watch Next

  • Schema 3.0 development. Watch for draft schemas and technical guidance from the Departments ahead of the February 1, 2027 release. Teams that review drafts early will have more than eight weeks to build.
  • December 11. The continuing resolution expires then. Until Congress passes full-year appropriations or another continuing resolution, treat new-start-dependent scope as conditional.

Sources

The Brief

Get each edition in your inbox

One email a week on what changed in regulated technology and what it means for the people delivering the work.

Subscribe